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Brussels, 14 February 2017 


Free Flow of Data 


The European economy is undergoing a transformation to a data driven economy, which heavily relies on cross-border data 
flows. The success of this transformation directly depends on companies’ ability to transfer personal and non-personal data, 
across borders in order to develop their business models, provide services to consumers and create cross-industry 
partnerships. However, existing direct and indirect restrictions to the free flow of data across the EU’s Member States, 
including in the area of national public procurement, undermine the competitiveness and growth of companies in Europe. 


As the Commission notes in the Communication, data localisation measures effectively reintroduce digital border controls 
which constrain the development of the EU data economy. Such protectionist measures prevent companies, including 
European SMEs, from scaling-up and entering new markets in the EU. As a consequence, customers’ access to state-of-the 
art technologies or cheaper services is limited, with a direct and negative impact on the uptake of cloud computing in Europe. 


We must also address the damaging misconceptions about data localisation, which are sometimes wrongfully justified as 
necessary assurances of stronger privacy and security. What matters in terms of security is how the data is stored, not where: 
the combination of state-of-the-art cloud computing together with modern cybersecurity tools and practices is the real 
enabler of secure storage and processing, rather than data localisation. Data localisation measures actually weaken security 
protections as they make centralised data easier to target thus more vulnerable to attacks. Also, data localisation can 
endanger the security of organisations and institutions which operate crossborder, as they rely on global information systems 
and cybersecurity tools and teams. In a nutshell, data localisation can actually weaken security and brings nothing but higher 
costs and fewer services to businesses and public administrations which need to store and process data in the Union. 


As the Commission rightfully mentions in its Staff Working Document accompanying the Communication, the trend in Europe 
is towards more, not less data localisation (+100% in 10 years), which may also explain the general misconception among 
administrations and businesses that there actually is a legal obligation to store data. 


Considering the significant obstacles localisation measures create for the European data economy, and their obvious 
incompatibility with the principles of the Single Market, we strongly regret that the European Commission has failed to 
introduce a legal instrument establishing the principle of free movement of data. This comes despite strong cross-sectoral 
industry desire for legislation and support from a majority of Member States. 


The vague and ineffective measures that are being proposed instead will not solve the problem: infringement proceedings 
against Member States are highly political and when launched take years to complete. The Commission indicates it “may 
also take further initiatives on the free flow of data”, but without further details. 


With data localisation measures being allowed to proliferate, building a European data economy and a (Digital) Single Market 
is simply impossible. We therefore renew our call for the European Commission to put forward a Regulation to establish the 
general principle of the free movement of data and to remove data location restrictions across the EU. The exceptional 
introduction of data localisation requirements by Member States should be pre-determined by a narrow range of acceptable 
justifications and subject to prior notification to allow for verification of their compatibility with EU law, including in the area 
of public procurement. 


DIGITALEUROPE 
Rue de la Science, 14 - 1040 Brussels [Belgium] 


T. +32 (0) 2 609 53 10 F. +32 (0) 2 431 04 89 
www.digitaleurope.org | info@digitaleurope.org | @DIGITALEUROPE 
Transparency register member for the Commission: 64270747023-20 


= 


>>) 


DIGITALEUROPE 


O») 


Data Access and Transfer 


Understanding each actor's role within the data processing chain is key and the rights on data are set by the contractual or 
licensing framework combined with the regulatory framework for personal data. 


Access to, transfer and the use of data, is already covered by the existing legal framework, including, data protection, 
competition, unfair commercial practices, contract and consumer protection law, intellectual property laws, including the 
database directive and the new trade secrets directive. To the extent that the processing (including access, transfer and use) 
relates to personal data, which is very broadly defined in Europe encompassing any data that has the ability to identify an 
individual, the rights of individuals are extensively regulated by the current and upcoming data protection rules. Rights of 
access and use between commercial parties processing both personal and non-personal data should be set by contractual 
relations between the various parties involved. Because we do not see a market failure or particular need, we are skeptical 
about the need for model contracts or model licenses. The flexibility of existing contractual practices, complemented by 
existing legislation is in our view sufficient. 


In the B2B context, the data accessed and used is usually defined through contracts between the different companies or 
organisations involved. Given the disparate entities potentially involved in the offering and differences in the nature and 
purposes behind the generation of certain types of data, we — as the majority of the respondents to the various consultations 
with the Commission - are not convinced that a uniform regulatory solution is preferable to existing contract negotiations. 
Not all of the actors involved in a ‘system’ will have equal claim to all types of data. Where additional analysis or combinations 
of data have been used to draw out new insights this is clearly added-value brought to the data by the processor in question. 
Even the customer who opts for a specific solution may not need access to all the data being generated. Some data may be 
business confidential, whereas in other cases they may decide they have limited interest in the data in question and may be 
willing to trade it against other advantages in contract negotiations. Without evidence that such negotiations are proving 
unworkable, we do not see a need for regulatory intervention. 


In the B2C context it is assumed that the data subject has the right under the current and future data protection rules to 
transparency and control with regard to the use of their personal data. However, there are clear benefits to sharing such 
information in an aggregated and anonymized format and the urge for an all-encompassing interpretation of the personal 
data definition should be balanced with these gains. For example, one must consider intelligent transport management 
which requires the collection of personal location data to map and predict traffic flow. Accuracy improves as more traffic 
data is connected. 


Regarding the various “options” presented by the Commission in the Communication: 


= Non-binding guidance based on existing legislation, on how non-personal data control rights could be addressed in 
contracts could be useful if at all necessary, if the objective is indeed to support companies in understanding national 
and EU rules better. 


= We agree with the objective of supporting the development and uptake of APIs through technical guidance and the 
identification of best practice for companies and public administrations. Having transparent and predictable API’s also 
aid interoperability and reduce lock-in to one specific vendor. 


= The principle of contractual freedom is an essential pillar of the data value chain, where no one-size-fits-all 
arrangements can preexist or be imposed unilaterally or via legislation. Again, guidance to end users is useful, 
particularly on the elements that users should expect to find in a services contract. The Commission’s work on SLA’s 
(Service Level Agreements) through the Cloud Specific Interest groups is useful support in that regard. 
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Also the recent set of ISO templates and standards on SLA’s is valuable. However, we do not see any need for mandatory 
default contract rules which would quickly become obsolete and counterproductive. Before such drastic measures are taken, 
it would be necessary for the Commission to explain what exact types of market failure exist and which specific imbalances 
in negotiating powers have been reported. In any case, such potential imbalances should not be addressed via legislation. 


= Regarding the access to data for public interest and scientific purposes, our position remains that such access should 
be negotiated through contracts rather than via legislation. Also, a discussion involving all stakeholders on what 
constitutes public interest data should precede any further action. In principle, DIGITALEUROPE is in favour of optimal 
re-use of data, provided that 


= granting access remains voluntary, with the right to opt out, 
= the protection of intellectual property, confidential information and personal data (e.g. privacy) is safeguarded, and 


=" applicable security rules (e.g. export controls) and legitimate commercial interests are respected. 


= The creation of a “data producer’s right” has raised a lot of concerns during the various consultations organised recently. 
Not only would such a right limit the flexibility that is necessary for companies to define and agree on contracts, it would 
also be difficult to determine and apply in practice. Also, existing legislation seems appropriate, along with contractual 
arrangements, to provide legal certainty to the parties involved. 


= We fail to see what a system whereby data holders would receive remuneration in exchange for providing access to 
their data would bring, when compared to the current situation in the market. Today, data holders are free to decide 
if, how and with whom they want to share the data they own. 


= In the absence of any demonstrated market failure it is clear that contractual relations and existing rules remain 
sufficient. It is premature to conclude that new legislation is needed, and we believe that market operators are best 
placed to decide which business models and contractual arrangements suit their needs. The existing rules should be 
carefully assessed according to various use cases, and soft regulation should be promoted. 


Liability 


Generally speaking, we do not believe that rules specific to loT are needed when it comes to assigning liability. The existing 
rules in the Products Liability Directive can apply to loT devices. In addition, like many other business models, the Internet of 
Things relies on complex supply and value chains which can involve a great number of service providers and users. In all 
those business models and equally for data driven services and connected products, liability is assigned in contract terms 
which provide the necessary legal certainty for parties in the supply chain. 


If the existing legal framework on liability rules seems appropriate, we do see a lot of value in the Commission’s proposals in 
this Communication regarding “Experimentation and Testing”, including for liability rules. We agree with the Commission 
that testing in real life environments with the involvement of all stakeholders should precede any conclusions on data 
emerging issues and liability. Experimentation and testing would also be appropriate regarding the development of fully- 
autonomous systems, which might benefit in the future from adapted liability rules. 


About the Commission’s proposed options in the Communication: 


=" The idea of assigning liability to market players “which are best placed to avoid the realisation of such risk” raises many 
questions and concerns. It is unclear who could impose such liability and which criteria would be used for this 
assignment. In our view, this should be left to contractual arrangements between parties in order to guarantee enough 
flexibility and adaption to each particular case. 
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= Although a discussion on insurance schemes would be useful, imposing insurance schemes could also produce 
unexpected effects on businesses as it may imply that data economy services are particularly risky. It should be left to 
businesses to decide if and how they want to contract insurance schemes. 
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Portability, Interoperability and Standards 


Encouraging the interoperability of systems and data portability are objectives the Commission should pursue, notably by 
promoting the use and, if and where needed, facilitating the emergence of industry-led standards. However, mandating 
standard contract terms for interoperability and creating data portability rights are not suitable instruments to achieve these 
goals. 


Interoperability is key to the functioning of the many services, infrastructures, and devices in the data economy. However, 
imposing the adoption of interoperable systems and models via government mandates generally does little to enhance 
competition and hinders innovation. Guidance and best practice on how to achieve interoperability, as well as possible 
voluntary industry initiatives, would be more appropriate. The main focus should remain with industry, and their efforts in 
the field of standardisation at global level. 


Regarding data portability, we agree that users should be able to switch providers as easily as possible. Considering the 
vibrant competition in the various data economy markets which drives service providers to facilitate portability, we believe 
that data portability is a key issue and will be achieved via the adoption and, if needed, further development of industry-led 
portability standards, provided such standards have been developed openly and transparently and tested among a variety 
of vendors. It is, furthermore, important to be able to reference global ICT technical specifications that have been developed 
in global fora/consortia following the same open and transparent processes. 


Additionally, guidelines and best practices can be very useful in advising cloud users before the standards become available. 
As such, and specifically regarding the potential measures presented in the Communication: 


a Current discussions on portability standards should be supported in global standards bodies including fora/consortia. 
What would hamper innovation and technology adoption are contract terms requiring service providers to implement 
the portability of a customer's data, 


= Weare not convinced that creating data portability rights is necessary or even advisable in the B2B context. 


Experimentation and Testing 


We fully agree with the Commission that before reaching conclusions on the suitability of possible solutions for data access 
and liability, dedicated trials should be organised for testing in a real-life environment, in the context of some of the issues 
identified in the Communication and in partnership with stakeholders. 


On experimentation and testing, we would like to ask the Commission to consider to enlarge the “connected mobility” 
concept - that remains still very much focused on connected cars - to include for example “connected drones”. In fact, a 5G 
test corridor for drones in a cross-border area would be an interesting pilot case. 


For more information please contact: 
Damir Filipovic, DIGITALEUROPE’s Policy Director 
+32 2 609 53 25 or damir.filipovic@digitaleurope.org 
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ABOUT DIGITALEUROPE 


DIGITALEUROPE represents the digital technology industry in Europe. Our members include some of the world's largest IT, 
telecoms and consumer electronics companies and national associations from every part of Europe. DIGITALEUROPE wants 
European businesses and citizens to benefit fully from digital technologies and for Europe to grow, attract and sustain the 
world's best digital technology companies. 


DIGITALEUROPE ensures industry participation in the development and implementation of EU policies. DIGITALEUROPE’s 
members include 61 corporate members and 37 national trade associations from across Europe. Our website provides 
further information on our recent news and activities: http://www.digitaleurope.org 


DIGITALEUROPE MEMBERSHIP 


Corporate Members 


Airbus, Amazon Web Services, AMD, Apple, BlackBerry, Bose, Brother, CA Technologies, Canon, Cisco, Dell, Dropbox, Epson, 
Ericsson, Fujitsu, Google, Hewlett Packard Enterprise, Hitachi, HP Inc., Huawei, IBM, Intel, iQor, JVC Kenwood Group, Konica 
Minolta, Kyocera, Lenovo, Lexmark, LG Electronics, Loewe, Microsoft, Mitsubishi Electric Europe, Motorola Solutions, NEC, 
Nokia, Nvidia Ltd., Océ, Oki, Oracle, Panasonic Europe, Philips, Pioneer, Qualcomm, Ricoh Europe PLC, Samsung, SAP, SAS, 
Schneider Electric, Sharp Electronics, Siemens, Sony, Swatch Group, Technicolor, Texas Instruments, Toshiba, TP Vision, 
VMware, Western Digital, Xerox, Zebra Technologies. 


National Trade Associations 


Austria: |OO Germany: BITKOM, ZVEI Slovakia: ITAS 

Belarus: INFOPARK Greece: SEPE Slovenia: GZS 

Belgium: AGORIA Hungary: IVSZ Spain: AMETIC 

Bulgaria: BAIT Ireland: ICT IRELAND Sweden: Foreningen 

Cyprus: CITEA Italy: ANITEC Teknikforetagen i Sverige, 

Denmark: DI Digital, IT-BRANCHEN Lithuania: INFOBALT IT&Telekomforetagen 

Estonia: ITL Netherlands: Nederland ICT, FIAR Switzerland: SWICO 

Finland: TIF Poland: KIGEIT, PIIT, ZIPSEE Turkey: Digital Turkey Platform, ECID 
France: AFNUM, Force Numérique, Portugal: AGEFE Ukraine: IT UKRAINE 

Tech in France Romania: ANIS, APDETIC United Kingdom: techUK 
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